yashsingh1/xdaforums huggingface dataset:
[Xperia Play Android Development] NeoandGeo:
Verizon probably sees handsets that users think are dead, when the bootloader is unlocked, a minor annoyance. But they REALLY do not want completely unlocked user-customizable phones on their network.
[Xperia Play Android Development] crono141:
Yeah, VZW are notoriously control freaks. I avoided a smartphone for the longest time because the verizon phones were always gimped in some way. I think there was a BB model that had its wi-fi removed, bluetooth protocols limited, etc. They had gotten better for awhile, round the time Droid 1 came out. Seems it was just a ruse to better their reputation and get better phones on their network. The corporate philosophy is the same: control control control.

This is America, Verizon. We don't want control. We want freedom.
[Xperia Play Android Development] NeoandGeo:
I remember feeling so relieved when I was able to hack my old WinMo 6.1 device to use the GPS in Google Maps instead of paying $10 a month for VZ Navigator. :)
[Xperia Play Android Development] hatcyl:
Ha ha! Don't worry about it at all! All awesome things brick phones first.

Your like a mad scientist, you have skills and can help out a lot ... your invention just went crazy this time.
[Xperia Play Android Development] ashergray:
To anyone willing to help us crack the unlock code generation algorithm you are more than welcome to join in. If it gets cracked we then get free unlock codes.

otherwise look into the paid solution someone else posted.

I will continue doing my part and snooping about a bit. I probably won't find anything mills already hasn't, but who knows.
[Xperia Play Android Development] crono141:
I remember earlier we were looking into a method of brute forcing the algorithm using just one key. We now have 11,000 plus keys. Would brute forcing the algorithm be more feasible now that we have more data points?
[Xperia Play Android Development] yifanlu:
Under the assumption that SE aren't idiots, I'd say that they are using a GOOD hashing/encryption algorithm. Why is it good? 1) high entrophy, 2) hard to relate hash to original data. If it is possible to take even a million keys and get a tiny bit closer to finding the algorithm, then they failed and it is a weak algorithm. therefore, I do not think Sony had invented their own hash algorithm, because it would be suspectiable to a weakness that would allow leaks. I suspect that they are taking a known algorithm (like md5) and are chang it up with something like XOR with a common key/generated key or adding something or swapping bytes around or any combination or something else. Note that is is purely spectuation.

Some aspects of the algorithm:

1) case sensitive

2) input is in ASCII string bytes not raw hex.

3) yields 64 bit hash (most common ones are 128bits (md5), 190bits(sha1), and 256bits(sha256))

4) high entropy

5) no common difference, aka appears to be psudorandom and knowing one hash will not help in finding another
[Xperia Play Android Development] ashergray:
from my research you are right on a few things

it is case sensitive.

it is psudorandom.

and I agree with you on it being input into the unlock algorithm as the ascii since it is case sensitive.

and while they are all very different unlock codes, I did feel like I was seeing certain numbers more than others.

and I don't believe it is just a 64bit hash, those are few and far between.

I have been thinking that since it is case sensitive when we enter the MEID/IMEI it converts it into hex and then applies the algorithm to it to produce our unlock code.

does this seem logical to you Yifanlu?

something worth checking out

http://www.insidepro.com/hashes.php?lang=eng
[Xperia Play Android Development] yifanlu:
Yes, it converts the ASCII string to hex (or more specifically, binary, since that's what works best in algorithm). However, we know it is a 64 bit hash since it is 16 characters long. That's 8 bytes which equals 64 bits. Now, as I've said before it may be a 128bit hash like md5 cut down and modified. In fact, I would put my money on that. And statistically, you may be seeing some numbers more often, but that's just chance. Generate 1000 random md5 strings and you would get the same conclusion.
[Xperia Play Android Development] chatch:
How does one find out if one of the 11I keys will work on me phoneski?
[Xperia Play Android Development] odst0016:
Ok so is there a possibility that my phones bootloader unlock has been generated if I did not submit it or is the only hope for me at this time paying for root. I have had my play for a few days I love it but don't know if I can live rootless
[Xperia Play Android Development] Cl8rs:
Quite honestly, paying for root is the most ridiculous thing I have ever heard. I NEVER had to pay to root my Ally, or even jailbreak my iPod touch. I seriously hope a dev finds some new exploit or something.
[Xperia Play Android Development] hexen2006:
IMO, it's OK to pay a little, The newer sets are always giving the devs a lot more trouble.:D

For Example Alejandrissimo method, it's free, he is not charging us, not even a penny, what he is charging it for some "credits" he need to purchase to able to make his method work. he is using his hard earn money to purchase the "credits" minimum pack.:cool:
[Xperia Play Android Development] Logseman:
Buy the phone carrier-free and you won't need to pay for bootloader unlock or root.
[Xperia Play Android Development] Cl8rs:
I'm not trying to rant or flame, its just...greedy. Why do we have to pay while other android owners can root whenever they please.
[Xperia Play Android Development] hatcyl:
Tell me about it, it's just not fair.

All these very talented developers spend their very valuable time finding ways to root a phone which is not designed to be rooted. A phone which I bought knowing that 'root' was not a feature that would be included.

They spend weeks researching, hacking, and maybe even bricking their phones.

And then some other developer make custom ROMS, kernels, themes, and other improvements that I can use to make my phone even better.

And one of these guys thinks about charging for their work?!

HOW DARE THEY! I deserve all the benefits of their work for free, BECAUSE THE WORLD REVOLVES AROUND ME!! They don't deserve anything for their work, no matter who benefits from it!

[/END RANT]
[Xperia Play Android Development] chatch:
Its this simple. Nobody can root r800x. Not after Sony cut us off. This guy charged me 24 bucks. Did all the work. Afterwards came back when my phone wouldn't boot into fastboot and figured out, amazingly, from wherever he was, that my usb cable somehow went bad inbetween him unlocking it and me trying to root it.

He paid for the dongle somewhere like 220. He paid for the 30 credits when I only need 5. if you do the math he made 9 bucks or something like that.

The service he is offering is worth 50 bucks if you ask me.

If all you can do is complain, do it yourself. In not capable, so I paid and now I love my phone a million times more.

Thanks again to the awesome dude that made my phone my ***** when I couldn't, and neither could you.

Thanks too to all the guys like asher and mills that worked their tails off trying to pimp a free way to do it. Eventually they will and you all can complain about that too im sure.
[Xperia Play Android Development] Cl8rs:
http://xdaforums.com/showthread.php?t=1241279

Read that. Jerk.

I understand its hard work and all, and I'm not trying to sound mean. I have been in the rooting scene for over a year now, and it's always been free of charge to root your phone.

And another thing, I started to see A LOT off assholes on here, this community isn't the nicest. No offense, some of are you are nice and willing to help guide us in the right direction. While A LOT of people on here tell us to search and ****. The search is terrible. And usually, not always, people post a question because they searched and STILL could not find an answer. Could you just spare your time and help us? No, you'd rather waste your time and life telling us to search. When usually its a simple yes or no question. Quite honestly, its sad.

[/END RANT]
[Xperia Play Android Development] chatch:
For sure, the search sucks
[Xperia Play Android Development] ashergray:
Please get back on topic guys.

there are currently 3 ways to go about cracking the bootloader.

1.)bruteforcing the SHA-256 RCK_H code in the bootloader. (takes forever)

2.)cracking the algorithm that produces the unlock code. (not as hard be requires alot of time and effort of people who know a thing or two about hashing algorithms)

3.)finding another loophole in SEs website.

if you find anything on SEs website DO NOT POST it PUBLICALLY.

also I do not condone illegal activity.
[Xperia Play Android Development] paxChristos:
Edit: Sorry Asher, was working on this post for a little while

easier way to search:

use google, enter site:xdaforums.com [what you want to search for goes here]

Blagus (i think) posted this somewhere, and i couldn't find it.

rooting:

Yes, many phones are easy to root. I had the HTC Aria, which following the 2.2 OTA Upgrade took atleast 3 months (that's how long i paid attention to it) to unlock the bootloader. Is the r800x easy? No. We had a temporary exploit, and Sony closed that hole, now our awesome devs with are trying to figure out another way to open it up to us. Thank you devs, you guys are awesome.
[Xperia Play Android Development] hatcyl:
Sorry Cl8rs, I just had to vent. We obviously have different opinions but let's not spam this thread.

---------- Post added at 12:04 PM ---------- Previous post was at 12:01 PM ----------

OK:

1. Bad idea. If you can do this in a feasible way then you have done way more than just crack a bootloader. You'll have the FBI gong after you :P

2. I think this is our best bet. I've tried a few things without any luck.

3. This might give us another temporary fix, but they will always be able to fix it. And if we go to far it might be considered illegal.
[Xperia Play Android Development] ashergray:
number 1 is not illegal at all.

anyone with a play and the omnius software can get their RCK_H code.

the problem is that it would take a very long time to crack it.

this is what I was attempting when I first tried to get it.

if we could cloud compute we would be more likely to achieve a few unlocks this way.

the problem with number 2 is that it could literally be any algorithm, and could very well be custom written for them.

and of course the problems with number 3 are self evident.
[Xperia Play Android Development] hatcyl:
For #1, is not illegal, but if you can do it then you would have cracked SHA-256 encryption.

That means that you would have cracked more than just the PLAYS bootloader.
[Xperia Play Android Development] yifanlu:
I don't think many of you understand that hashing is a one way function. They are designed to never be reversed or to be able to find what the algorithm used is. If you can "crack" it, you would destroy the entire crypto security interface in the world. The only chance we have of "finding" the algorithm is guess and check and that's under the assumption that Sony is taking a existing one way algorithm and modifying it. There is no pattern to see, no numbers to guess. The chances of finding the algorithm without any data is the same with 1 million keys and their origin text. If the hash function is a completely original algorithm developed by Sony, or if they apply like 10 additions to an existing algorithim, we would never crack it. Ever. Our "best" hope is for an angry ex-employee to leak it.
[Xperia Play Android Development] Cl8rs:
Apology accepted. Thanks man :)
[Xperia Play Android Development] ashergray:
its called brute forcing and is entirely capable of cracking most sha-256 hashes.

and yes while they are one way they can be bruteforced and rainbow cracked.

if you check back to the start of this thread I had some mild sucsess with it.

but being that the unlock code is 16 digits made it that much harder.
[Xperia Play Android Development] yifanlu:
Talking about SHA256 of the hashed key that is found in the TA:

Modern hashes including SHA and the SHA256 variety CANNOT be brute forced. Well, technically, they can be. But it will take more time then the life of the universe to do. If by "rainbow cracked" you mean "using a rainbow table", then you need to first generate a rainbow table for SHA256 and you will see when you try that it will also take at least a few centuries (if computing power grows at the current rate) to create a complete database for all the keys. I don't know what you consider success (and I mean no offense, seriously) but a key is either cracked or not. "that much harder" is an understatement. It is physically (not theoretically) impossible.

If some of you don't believe me, I'll show the math.

According to this: http://stackoverflow.com/questions/4764026/how-many-sha256-hashes-can-a-modern-computer-compute a quad core computer can calculate 65139 keys per second. If we want to generate a database of all 0xFFFFFFFFFFFFFFFF keys, we do some simple division and conversion and it comes out to be 8.98 million years. (http://www.wolframalpha.com/input/?i=(0xffffffffffffffff/65139)+seconds+in+years) Now that is under the assumption that one computer is being used and no growth in computer growth rate occurs. What if we use a network? Let's assume 100,000 people join and all own high end computers. That's still about 90 years.

What if you are only generating enough keys until you get your own key? First of all, that means we cannot assume the use a network. Secondly, each key is completely random so we have the same chance of it being 0000000000000000 then it is FFFFFFFFFFFFFFFF. My key happens to be "EBDB0F391295E3B8" that will still be 8.2 million years (for me). However it can be any time between 1 second and 9 million years. It's your chance.

What if you keep generating random keys until you find your own key? But there is a 1/0xFFFFFFFFFFFFFFFF chance every 1/65139 second, you will find your key. According to wikipedia, http://en.wikipedia.org/wiki/Lottery#Probability_of_winning, you have a 1/0xd56048 (I'm using hex for comparison) chance of winning the lottery. So it's like playing the lottery once every fraction of the second and hoping to win 3 times in a row. Wikipedia says "Or if one bought a ticket every other second for one year, he would probably win the jackpot just once."
[Xperia Play Android Development] ashergray:
I fully understand all of that.

seriously though if you read through the start of the thread you will notice that none of this is new information.

also if your going to crack with anything

use your GPU not your CPU, they are far more capable

http://hashcat.net/oclhashcat-lite/

http://www.insidepro.com/eng/egb.shtml

using ocl-hashcat-lite you can crank out

SHA256	1158 Million tries/sec

with a Windows7, 64 bit Catalyst 11.6 1x ATI hd5970 stock core clock

according to their website.

thats pretty dang quick.

the only problem is that is still not fast enough.
[Xperia Play Android Development] yifanlu:
You said a few posts ago

That was the statement I was rebutting. It might have been said before (I didn't see it, can someone post a link, thanks and sorry), but I was just making sure the people who didn't know won't be misinformed.

You might have meant "it is entirely capable of cracking ALL sha-256 hashes if given infinite time", as that would be more clear. I don't mean any disrespect, I just don't want people to get the wrong idea that they can somehow crack the key with just the sha256 hash in the ta.
[Xperia Play Android Development] hatcyl:
I'll have to agree with yifanlu, if you can crack Sha-256 then you will have a few thousand organizations worried, not just Sony Ericsson.

Unless you have a quantum computer you are hiding from us.
[Xperia Play Android Development] ashergray:
nope no quantum computing just yet, in my house at least.

and I should have made my self clearer.

but yes even with several very amazing gpu setups it would still take us close to 1000 years to crack the rck_h key in the ta.

perhaps we can find some other way.

anyone have any idea how the new paid service works?

i am not familiar with it but we might find some type of lead by following what it does when it unlocks.
[Xperia Play Android Development] yifanlu:
I know nothing about the paid tools (disclaimer), but I would guess it is somebody with access to sony/cell provider's unlock servers. Maybe a second hand cell phone retailer in china or something?

Unrelated: What do most people root for? Overclocking? Would a userland root like gingerbreak allow custom kernels? Because I'm thinking maybe we should not focus on cracking the key but another way to root. If someone can give me a rip of the bootloader, I can try to look for holes like the iPhone dev team does to jailbreak the iPhone.
[Xperia Play Android Development] odst0016:
Wasn't something similar done with the Droid 2? I read they never cracked the bootloader.
[Xperia Play Android Development] crono141:
This seems a good idea, to achieve root at the very least.
[Xperia Play Android Development] edokassiah:
yeah i mean i wasnt reallt all that interested in flashing roms etc let alone overclocking

i just genuinely just wanted root to remove bloatware on my r800x to speed it up

better yet where can i get the stuff i need to remote unlock i wouldnt mind buying hardware etc

setool box 3 or some shii right?
[Xperia Play Android Development] Cl8rs:
Agreed.

All I want is to freeze bloatware and wireless tethering. The phone is fast enough, so overclocking isn't for me :D
[Xperia Play Android Development] Dyelon:
How are you thinking of rooting? I'm not sure what method to do
[Xperia Play Android Development] Bin4ry:
Well let me say something here ;-)

Commercial tools are often just a userfrontend to SE emma software.

Also i would love to see a discussion of the securityimplementation which SE did. But not on this level you were taking before.

It is just stupid and riddiculous to talk about bruteforcing anything without thinking about this before.

So if you not studied math/natural science/computer science/enigneering and have a good understanding of math there is no need to discuss.

There are 2 ways to go:

1. find a bug in securityimplementation and use it to bypass security at all

2. we cam start discussion about this security in a very high and mathematic level which will leave about 99% of users not understanding anything.

i am fine with both :-P

Regards
[Xperia Play Android Development] thatsupnow:
What an a hole you are Buddy. How dare you to even put up a post as stupid as that, if you don't like it go somewhere else or figure it out on your own since your too damn cheap!
[Xperia Play Android Development] yifanlu:
I agree. There is absolutely no way brute force ever or will ever work on ANY technology younger then 10 years. That's why I was so adamant in proving just how unviable it is a few posts back (and I still haven't gotten a link to where my request of where the information was posted before). In almost every, um, community, that I've seen where people want to "hack" something (360, 3ds, calculators, etc), there is always someone (and more then one) who throws in the idea of "brute forcing the key" and the misconception of how cryptography works is farther cemented by Sony's leaking of the PS3 keys (which was just a stupid misimplementation of security).

[/useless details]

What do you mean by "security implementation"? Are you talking about SE's custom android software? The kernel? The bootloader? FOTA and the other stuff that's flash-able via flashtool? My idea for a userland exploit is to look through the executables with root permission (/system/bin and /system/lib) and find a exploit or something. Maybe with custom SE software, as I'm pretty sure Google would do a better job with security. It would also be nice if I know the format of stuff like loader.sin so I can disassemble it.
[Xperia Play Android Development] ashergray:
I think that was meant to be sarcasm.
[Xperia Play Android Development] crono141:
Yeah, your sarcasm detector is seriously busted. He was actually ranting at another user who had the same attitude as he's parodizing.
[Xperia Play Android Development] Cl8rs:
The only method available is the paid one, thats it. I'm waiting because I'm really uncomfortable with unlocking my bootloader.
[Xperia Play Android Development] paxChristos:
Hey guys, I'm curious, is there any way to manually convert the MEID from hex to decimal for a correct bootloader unlock code?
[Xperia Play Android Development] NeoandGeo:
How exactly does the paid method work?
[Xperia Play Android Development] paxChristos:
One of the guys in the general section remote unlocks it. Cost something like 25usd. You also need a paperclip.

So fast everybody sent his way sounds completely completely satisfied.
[Xperia Play Android Development] NeoandGeo:
Sounds hella weird, haha. But good there is a backup plan if we are never able to patch the hole.
[Xperia Play Android Development] ssego:
I just acquired an Xperia Play for VZW. Any chance someone has the code for the MEID A100001710D8DB?
[Xperia Play Android Development] yifanlu:
The only unlock codes in our database ends at A10000170xxxxx. Sorry.
[Xperia Play Android Development] Mogul345:
I was perusing the State of Devlopment thread and saw this post.

Perhaps this redbend_ua tool could be useful for those that are still locked? If we could attain root first, maybe this tool could be used to do the writing to the NAND that the locked bootloader prevents? Just brainstorming.

I saw that the Droid 3 has root now. Anyone know anything on the exploit they used?
[Xperia Play Android Development] Mills00013:
Mogul, the D3 exploit is exploiting a Motorola vulnerability through their code (in blur I believe) so non-moto devices need not apply.
[Xperia Play Android Development] Mogul345:
Blast! It figures though. Proves yet again that the hardware companies stink at writing software.

I still can't believe that there hasn't been an exploit found in Gingerbread since Gingerbreak. People still find vulnerabilities in all sorts of OS's to execute arbitrary code, but no one seems to be able to find one in Android anymore? I'm not a hacker by any means, but it still blows my mind.

Ok, next brainstorming idea. The HTC folks have been using UnrEVOked and REVOlution to unlock the NAND on HTC devices. Any chance there's a similar path to be exploited here?
[Xperia Play Android Development] paxChristos:
no, i don't think that'll work, it's a different way of locking stuff between HTC and SE... unfortunately...

Unrevoked is a flashing utility that allows (some) HTC devices to flash a custom rom (needs bootloader unlocked)

Revolution is a bootloader unlocking utility that is focused on a security flag build into some HTC Bootloaders.
[Xperia Play Android Development] decaydance99:
i am coming from a Fascinate and i want root soooo bad and have been reading and was thinking about going with the paid solution. i think it is 20-25$ any ways i want to be fully prepared before i go through with it, my question to you guys is what do i do after i get my bootloader unlocked? do i automatically get root or do i have to do additional stuff, and if a get a OTA will it re lock my BL or will it brick me? Just got word that cyanogen mod will be offically supporting the xperia play so i really want to go through with this, please help guys
[Xperia Play Android Development] paxChristos:
If you go through the guy in the general thread (alejandrissomo (close, but not right spelling)) he'll get you setup right...

Unlocking the bootloader does not give you root, but it allows you to flash the only (current) way to root your phone

DO NOT OTA AFTER UNLOCKING IT, IT WILL BRICK YOUR PHONE!
[Xperia Play Android Development] hatcyl:
Does the paid method support re locking the bootloader?

Just curious, it's a must for OTA.
[Xperia Play Android Development] decaydance99:
So since CyanogenMod said they will fully support 2011 xperia phones will that include the verizon play?